eventgen config review

guilhemmarchand · Aug 15, 2017 · c35c9c7 · c35c9c7
1 parent de60287
commit c35c9c7
Show file tree

Hide file tree

Showing 20 changed files with 11,453 additions and 281 deletions.
diff --git a/TA-nmon/default/eventgen.conf b/TA-nmon/default/eventgen.conf
@@ -0,0 +1,43 @@
+# eventgen.conf
+
+# The eventgen samples come from real system running in the IBM Power development plateform (PPD)
+# These are key value invents from the TA-nmon-hec
+
+# Deploy the Splunk eventgen from https://github.com/splunk/eventgen under $SPLUNK_HOME/etc/apps/SA-Eventgen
+# Create an index called "nmon" and restart Splunk
+
+[nmon_performance_sample]
+count = 100
+index = nmon
+sourcetype = nmon_data:fromhttp
+source = perfdata:http
+interval = 10
+earliest = -1m
+latest = now
+
+## Replace timestamp
+token.0.token = timestamp=\"(\d*)\"
+token.0.replacementType = timestamp
+token.0.replacement = %s
+
+token.1.token = ZZZZ=\"(\d{4}-\d{2}-\d{2}\s\d{2}:\d{2}:\d{2})"
+token.1.replacementType = timestamp
+token.1.replacement = %Y-%m-%d %H:%M:%S
+
+[nmon_config_sample]
+count = 4
+index = nmon
+sourcetype = nmon_config:fromhttp
+source = configdata:http
+breaker = timestamp=\"([0-9]*)\"
+# it does not work without:
+bundlelines = true
+
+## Replace timestamp
+token.0.token = timestamp=\"([0-9]*)\"
+token.0.replacementType = timestamp
+token.0.replacement = %s
+
+token.1.token = date=\"(\d{2}-\w{3}-\d{4}:\d{2}:\d{2}:\d{2})"
+token.1.replacementType = timestamp
+token.1.replacement = %d-%b-%Y:%H:%M:%S
diff --git a/TA-nmon/default/eventgen.conf.spec b/TA-nmon/default/eventgen.conf.spec
diff --git a/TA-nmon/default/inputs.conf b/TA-nmon/default/inputs.conf
@@ -134,18 +134,3 @@ index = nmon
 interval = 14400
 source = nmon_cleaner
 sourcetype = nmon_clean
-
-###########################################
-#			SA-Eventgen
-###########################################
-
-# All these stanza are related to Eventgen configuration, for App testing purposes, Evengen will generate various sample data
-# These settings can be safety ignored in Production systems as they will never affect anything as long as Eventgen inputs are not activated
-
-[batch://$SPLUNK_HOME/var/log/nmon/eventgen/*sample.csv]
-
-disabled = true
-move_policy = sinkhole
-crcSalt = <SOURCE>
-index = nmon
-sourcetype = nmon_data
diff --git a/TA-nmon/samples/AIX_CPU_ALL_sample.gz b/TA-nmon/samples/AIX_CPU_ALL_sample.gz
diff --git a/TA-nmon/samples/AIX_LPAR_sample.gz b/TA-nmon/samples/AIX_LPAR_sample.gz
diff --git a/TA-nmon/samples/AIX_MEM_sample.gz b/TA-nmon/samples/AIX_MEM_sample.gz
diff --git a/TA-nmon/samples/DISKXFER_sample.gz b/TA-nmon/samples/DISKXFER_sample.gz
diff --git a/TA-nmon/samples/Linux_CPU_ALL_sample.gz b/TA-nmon/samples/Linux_CPU_ALL_sample.gz
diff --git a/TA-nmon/samples/Linux_MEM_sample.gz b/TA-nmon/samples/Linux_MEM_sample.gz
diff --git a/TA-nmon/samples/Linux_TOP_sample.gz b/TA-nmon/samples/Linux_TOP_sample.gz
diff --git a/TA-nmon/samples/Solaris_CPU_ALL_sample.gz b/TA-nmon/samples/Solaris_CPU_ALL_sample.gz
diff --git a/TA-nmon/samples/Solaris_MEM_sample.gz b/TA-nmon/samples/Solaris_MEM_sample.gz
diff --git a/TA-nmon/samples/Solaris_TOP_sample.gz b/TA-nmon/samples/Solaris_TOP_sample.gz
diff --git a/TA-nmon/samples/Solaris_WLM_sample.gz b/TA-nmon/samples/Solaris_WLM_sample.gz
diff --git a/TA-nmon/samples/collect_sample.gz b/TA-nmon/samples/collect_sample.gz
diff --git a/TA-nmon/samples/config_sample.gz b/TA-nmon/samples/config_sample.gz